I had high hopes for the group. It was the culmination of something I've been ruminating on for almost a decade (see post number 12 on my blog, dated to January 2004, for proof). My thoughts have mainly been around coding standards and best practices, helping educate developers around their benefits, and how to leverage both in order to create maintainable code.

He talks about some of the things he sees as shortfalls of the group including the definition of some of the standards (and interface structure), the current thoughts of changing of said standards and some of the "discussion" that happens in the group via the mailing lists and pull requests. He mentions that there were several times that the same discussions would happen all over again, despite people saying it had, and is tired of it.

I have better things to do with my time, things I want to create, software I want to support, hobbies and interests I want to pursue. Debating brace placement, tabs vs spaces (for the umpteenth time), or whether or not annotations have a place in programming in a dynamic language? Not so much.

Once you start to dig around PHP Security in earnest, you begin to notice trends and patterns in how programmers behave and accumulate knowledge. The most obvious feature of PHP culture is that we do not have an active "leadership" in security. There is no appeal to authority in PHP security debates, only personal opinions informed by a nebulous entity called "They". There are individuals that I have learned to trust and that's about as far as we can go. [...] In the PHP community, the Authorative Knowedge for PHP Security is derived from a concensus. A concensus based on published articles, the practices of libraries and frameworks, printed books, and the vague meandering thoughts of whoever you follow on Twitter. In other words, our current Authorative Knowledge is you.

He notes that this "everyman security expert" hasn't proven to be the best method for increasing the overall security awareness of PHP developers, so he's proposing something different: the "PHP Security Technical Group (SECTG)".

It's a group of members who share a common interest in sharing information, performing research, publishing articles/newsletters, and generally taking advantage of resource pooling without giving up their individual interests - all towards accomplishing some common goal, i.e. creating or emphasising new Authorative Knowledge. The phrase "Unofficial" is implicit in the group name - this is not an official PHP entity.

If you're interesting in joining in on the cause, you can sign up for the mailing list and get more information as it comes.

The FIG stands for Framework Interoperability Group. The name until recently was "PHP Standards Group" but this was somewhat inaccurate of the intentions of the group. [...] The idea behind the group is for project representatives to talk about the commonalities between our projects and find ways we can work together. Our main audience is each other, but we're very aware that the rest of the PHP community is watching.

The FAQ answers other questions about the standards the group has agreed on (passed) so far, who the members of the group are, how to get involved and how framework communities can get involved.

Anthony, whose views always make good reading, raises concerns about the way in which this group generates standards. He contrasts the current approach to RFC 2026 which defines the IETF's Internet Standards Process. [...] Where Anthony's arguments seemingly fall flat is that the FIG is not the IETF. The Framework Interoperability Group was founded to allow cooperating members to develop shared standards. It does not claim to be PHP's standards body and so there is no obligation for any PHP programmer to adopt their standards (unless they work on a member project obviously!).

He points out that the standards group's process has been slowly opening more and more ("by inches") and that the group, while made of up individuals, is more than just a collection of people - it's representatives for well-known Open Source projects.

In other words, the FIG is actually something really really good for PHP. PHP needs standards so we can make interoperability between various frameworks and applications a true reality. The hodgepodge of APIs and standards we've relied on to this point only serve to reinforce PHP's NIH obsession. [...] What the FIG should do, in my opinion, is clearly define its purpose and better document its bylaws/processes. [...] It really all comes down to better communication and pushing the community engage with the FIG.

During the /dev/hell podcast at Tek12, someone asked the guys their opinion about PSR. [...] The person asking the question had asked about PSR1 and PSR2. These are the first two standards proposals in the group and they deal with coding standards. [...] There are already coding standards for PHP and any other language out there. Why does anyone need to make a new one? [...] This reminds me a lot of Open Source licenses. There are tons of these things. And in the end, most (GPL has its issues I know) of the open source licenses represent the same idea.

He goes on to talk more about the feedback he's gotten from other PHP community members about the target of the group and his thoughts on the naming of both the group and the standards they're generating.

In the end, cooperation is good. And if these guys want to cooperate I say more power to them. I just hope they get into really good things soon. Like, can we talk about a maximum number of files, functions or classes used for any one single page execution? *That* would be valuable to the PHP community.

Among the group, Paul Jones has been writing serveral proposals under the PSR-1 standard banner that include:

• The basic draft of the standard
• An extended draft of the same
• A more advanced version, PSR-2 that also includes some survey results on various syntax elements.

If you want to know more about the PHP-FIG group, you should listen to this excellent panel interview of the group from the Voices of the ElePHPant podcast. Paul and others get into the point of the group and how the standards are progressing.

So, what are the advantages of an ACL model? The first advantage is security. Using this model will make your application more secure and less vulnerable to exploits. When securing any program, it is good to give to the user only the privileges he/she needs. That means that, for example, you should not give super administrator privileges to someone who will only manage website content. The ACL security model allows you to do just that. The second advantage is the easiness of user management. You can divide users into groups, while each group has certain access permissions. Also, you can easily add new user groups, delete the old ones or change group permissions.

They include the database structure you'll need to make the backend work (four tables) and the code to create an "Acl" class with methods to check a user+group for a permission, get the permissions for a user and get the permissions for a group. It's a pretty simple system and has a lot more that could be added to it to make it more robust, but it's a good start.

Cal's questions center around the Standards group and what kinds of discussions they have about the language and the progress the group has made so far (like PSR-0):

• What's the purpose of the group?
• Is the purpose of this group to take PHP from everyone's hands and enforce the "one true grace" on everyone?
• Is the group fulfilling its purpose or is it wandering off the path?

You can listen to this latest episode either via the in-page player, by downloading the mp3 or subscribing to their feed.

The other day I was debugging an error in one of my unit tests, and found it hard to track down because when I ran PHPUnit, it ran all the tests contained in the file where my problem unit test was located. After some Googling and reading the PHPUnit Api Docs, I found that you can specify a test, among other tests, by adding a comment with the @group annotation.

Using this "@group" annotation tells PHPUnit to combine these tests and allows you you specify a "--group" setting on the command line to only run those. He includes some sample code showing how it can be used. This can be very useful for combining results for certain kinds of tests (say, all related to bugfixes) without having to run everything all over again.

So how can you practice using regex if you are limited to just using them in your code? The answer is to use a utility, of which there are many, that uses regex for performing search and replace. I'm sure everyone is familiar with the standard "find x and replace it with y" type of search and replace. Most IDEs and text editors have built in regex engines to handle search and replace. In this article I'd like to walk through a series of exercises to help you practice using regex.

His examples are based on Netbeans but can be used in just about any IDE that supports regex (or even just your code). He shows how to match word boundaries, do some grouping, work with back references and doing some search/replace based on multiple groupings.